Legal
Privacy policy
What we collect, why, and who else sees it. Written plainly, for volunteers, parents and coordinators.
Last updated
The short version
- We collect what the service needs: your name, email and birth date, your check-in times, and what you choose to add.
- Under 13 can’t join. Ages 13 to 17 need a guardian’s OK to share a record, and don’t get direct messages.
- No coordinates are ever stored. The optional leave-the-area check keeps only a time, and it’s deleted at verify.
- Some features send data to Anthropic or OpenAI to draft text. A person confirms every draft.
- No ads, no tracking, no selling data. You can download or delete your data any time.
01Who we are
SycaMore Live is a student project, started at Cal Hacks 13.0 in October 2026 and running as a demo. It records volunteer hours at events: volunteers check in and out, the organization that ran the event confirms the hours, and each volunteer gets a record anyone with the link can check.
Two kinds of people use it. Organizations (a coordinator signs in with a PIN) create events and confirm hours. Volunteers join, check in, and keep their records. An organization decides what goes on its records; we run the tool.
While this is a demo, please don’t put anything in it you’d need to keep private. The demo data you see on this site uses made-up names.
02What we collect, and why
Only what the service needs to work. Here is all of it.
Volunteers
| What | Why |
|---|---|
| Name, email and birth date | To make your account, put your name on your records, and apply the age rules (under 13 can’t join; 13 to 17 have extra protections). |
| Your Google account ID, if you sign up with Google | So “Continue with Google” signs you back in. We get your name and verified email from Google, nothing else. |
| Check-in and check-out times, and how you checked in | These are your hours. They’re timed on our server, not typed by you. |
| What the coordinator adds when confirming: your role, any changed hours with the reason, a “standout” star | This is the organization’s statement about your service. A changed hour always carries its reason. |
| The leave-the-area signal, only if you and the event both turned it on | When you were first seen outside the event’s area and roughly how far away. No coordinates are stored, and it’s deleted when the event is verified. |
| Records, share links and badges | So you can share a record and anyone with the link can check it. |
| Messages and event chat posts, and when they were read | So organizations and volunteers can talk. Volunteers under 18 only get announcements. |
| Events you save, your personal hours goal | Features you chose to use. |
| When you accepted the Terms, and whether you opted in to announcements | To keep a record of your consent. Announcements are off until you turn them on. |
Text you paste into Discover’s profile box stays in your browser’s memory. It is never sent to us or stored.
Organizations and coordinators
| What | Why |
|---|---|
| Organization name, type and city; coordinator name, phone and email; the PIN | To sign you in, and so volunteers and record readers know who to contact. The contact details appear on records and event pages. |
| Events: title, time, place and notes | To run the event. Each event has a public page; the check-in code is not on it. |
| Photos of paper sign-in sheets | Sent to Anthropic to draft rows for you to confirm. We don’t keep the photo. |
| Event story: voice debriefs, their transcript, video clips and still frames | To draft a story about the event. Voice notes stay private. Clips you mark as consented can appear on a published story page. |
Everyone
- Cookies. Essential only.
vidkeeps a volunteer signed in (1 year),oidkeeps a coordinator signed in (30 days), andsm-hide-lessonremembers that a coordinator hid a tip. Your light or dark theme is saved in your browser’s local storage. No analytics, advertising or tracking cookies. - Server logs. Our host keeps short-lived request logs (IP address, page, time) to run and secure the service.
03Our legal basis
Where privacy law asks us to name a reason for using your data, these are ours:
- To provide the service you signed up for: your account, check-ins, hours, records and messages.
- Legitimate interests: the organization’s need to keep an accurate record of who served, and our need to keep the service secure.
- Consent: announcements from organizations, the leave-the-area check, signing up with Google, and sharing a record. You can withdraw any of these at any time, and it stops from then on.
04Minors
Many volunteers are teenagers, so the rules for minors are built into the data layer, not just the screens.
- Under 13 can’t join. Sign-up refuses, and nothing is stored, online or at an event’s door.
- Ages 13 to 17 can join and keep their hours, and must confirm that a parent or guardian knows they’re using SycaMore Live. Sharing a record needs a guardian’s OK; until then the server refuses.
- Messages: under 18 gets the organization’s announcements only. No event group chats, and no direct messages with coordinators in either direction.
- Event stories: Claude flags video frames where people, possibly minors, can be recognized, and only clips the coordinator marks as consented can be published.
A parent or guardian can ask us to see, correct or delete a minor’s data. See “Contact”.
05Who else sees your data
We don’t sell your data or share it for advertising. These services handle some of it so the app can work:
| Service | What it receives | When |
|---|---|---|
| Anthropic (Claude) | Photos of paper sign-in sheets; pasted event text, links’ content or flyer photos; event story transcripts, video still frames and the event’s verified facts; facts for a broadcast draft; a record’s facts for “Use this record” when OpenAI isn’t set up. | Only when a coordinator or volunteer uses one of those features. |
| OpenAI | A record’s facts (organization, event, date, role, hours) to draft a resume line or scholarship sentence. Nothing you typed. | Only when “Use this record” is used and the app is set up to use OpenAI. |
| Vercel | Every request, as our web host. | Always. |
| Neon | The database, as our database host. | Always. |
| Your sign-in, to confirm who you are. | Only if you choose “Continue with Google”. | |
| Your browser’s speech service | A coordinator’s voice debrief, to show a live transcript. In Chrome this audio goes to Google. | Only while a coordinator records a debrief. |
| OpenStreetMap | Place searches typed by a coordinator; the map on an event page loads from OpenStreetMap. | When searching for a place, or viewing an event page with a map. |
We use these providers’ paid APIs, not their consumer apps. Their own terms govern how long they keep what we send. AI output is always a draft: a person confirms it before it counts.
Public by design. A shared record’s link, a badge’s link, an event page and a published story page can be opened by anyone with the link. They ask search engines not to index them. The check-in code and your email and birth date never appear on them.
06How long we keep it
- Your account and records: until you delete your account, or until the demo database is reset, whichever is first.
- Leave-the-area signal: deleted when the event is verified.
- Sheet photos: not kept; only the rows the coordinator confirms are saved.
- Voice notes and clips: until the coordinator deletes them.
- Cookies: 1 year (volunteers) or 30 days (coordinators), or until you sign out.
Details, and what deletion keeps, are on Your data.
07Keeping it safe
Every connection is encrypted (HTTPS). Sign-in cookies can’t be read by page scripts. Verified hours are locked by a database rule, so nobody can quietly edit them later. Pasted links are only fetched from public addresses, and text inside sheets and pasted material is treated as data, never as instructions.
To be straight with you: sign-in is demo-grade. Coordinators use a PIN and volunteers are recognized by a cookie. Real sign-in is planned before anyone relies on this outside a demo. We haven’t had a security audit and don’t claim any certification.
If something goes wrong, our breach steps are on Your data.
08Your rights
Wherever you live, you can:
- See and download everything about you: Account → Download my data gives you a JSON file.
- Delete your account: Account → Delete my account.
- Correct your name or email: ask the organization or us. Hours are corrected by the organization that confirmed them.
- Withdraw consent for announcements or the leave-the-area check, at any time.
- Complain to your local data protection authority if you think we got something wrong.
We don’t sell or share personal information for advertising, so there’s nothing to opt out of there.
09Changes to this policy
If we change what we collect or who we share it with, we’ll update this page and the date at the top, and tell signed-in users in the app before the change applies to them.
10Contact
For any privacy question or request: We haven’t set up a dedicated address yet. Until we do, ask the organization you volunteer with to pass your request to us, or find the team through the About page. We’ll answer within 7 days.